# xm31.top — SUSPICIOUS

> xm31.top is a crypto drainer impersonating Blockchain.com. Flagged by 1 of 95 VirusTotal vendors. Verify with PhishDestroy before clicking.

## Summary
PhishDestroy identifies xm31.top as an active crypto drainer posing as Blockchain.com. This domain is currently live and operational, with confirmed malicious intent to deceive users into exposing their digital assets.


This domain was flagged by 1 of 95 VirusTotal security vendors, indicating poor detection despite clear malicious intent. It resolves to IP 104.21.13.189, operates under a Let's Encrypt SSL certificate, and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 31, 2026. With such a recent creation date and minimal detection coverage, users should exercise extreme caution. The domain exhibits no legitimate trust indicators and appears engineered solely to exploit uninformed visitors.


Current status remains active, requiring immediate user avoidance and proactive blocking. PhishDestroy strongly advises verifying all links via its platform before any interaction. Additionally, users exposed to this site should scan connected wallets for unauthorized transfers, change passwords used on suspicious sites, and report the domain to hosting providers for takedown. The combination of low VirusTotal detection, deceptive registration data, and recent creation date underscores elevated danger for cryptocurrency users.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-31 18:43:37
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 104.21.13.189

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/6e912334-f865-462d-a477-2e0dbccf5914
- PhishDestroy: https://phishdestroy.io/domain/xm31.top/
- LLM endpoint: https://phishdestroy.io/domain/xm31.top/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/xm31.top/
Last updated: 2026-04-01